Anyone can register as a doctor due to weak Invite key

**You are viewing our old website - new website soon...!**

We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.

Stay tuned for updates coming soon!

FirstBlood-#440 — Anyone can register as a doctor due to weak Invite key
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-25, newrouge Level 3 reported:


        Hey, As it was mentioned in scope that doctor registration is testing phase so i guesses it might be vulnerable state. So i figured out that anyone can register as doctor with "INVITE-KEY: test".
Steps:

Go to /register.php
Pick a username and put test as invitecode.
You have successfully registered and can access doctor panel with username and password provided.



Thank you
newrouge

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: register.php

Parameter: invitecode

Payload: test

FirstBlood ID: 24
Vulnerability Type: Auth issues

The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.